flipoff-split-flap-display

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md "Common Patterns" section includes an explicit fetch example (fetch('/api/departures') — "e.g., a flight API") that ingests third‑party JSON and uses it to build and display messages via board.setMessage (and trigger sound.play), so untrusted external API/content could directly influence runtime behavior.